fix(desktop): order same-name agents using your recent choices

[loganj]

🤖

Summary

Your recent @ mention choices now rank first the next time you search — without ever reordering a list you're already looking at.

• Only real choices are remembered. A mention counts only when it is actually inserted and passes the live admission check from fix(desktop): check access again when you select or pin an @ mention #7196; denied or stale selections record nothing.
• Recent choices rank first on the next search. When several same-name agents tie for a slot, the one you chose most recently comes first — even above an agent you own. Before, the agent you own always won that tie, no matter what you had just chosen.
• An open list never moves. New choices only affect the next snapshot; they never reorder the identities, labels, or selection of a list that is already open.
• History is bounded and scoped. The record is capped in size, kept per viewer and per channel, and cleared when you switch communities.

Part of the mention-chooser stack on the shared #7190 recovery prerequisite: #7190 → #7196 → #7323 → #7197 → #7239 → #7240. This feature stack remains separate from #7191 → #7192. This PR builds directly on #7239.

Related issue

Continues the merged mention-editor work from #7124 (authorize remote mentions at publication) and #7128 (preserve spacing after multi-word mentions). No separate tracking issue for this slice.

Testing

Current accepted replay (2026-09-09)

Published head ed502a18b941786a187fb69a54cab47e31c93de5, tree f01223931881fb2a2981deaa7d7b3dae85d6a1a7, base 479bbe0f17d7635c48e00b5f7280350b1d8b2dba. Only #7239, #7240 and #7542 were advanced in one atomic exact-lease push; the other six stack heads are unchanged.

Closes the shared community-reset coverage finding in reviews 5159942011 and 5159947440. The community-rail regression records a real admitted choice and proves its next-open promotion, drives actual A→B→A community navigation through the production reset seam, binds the returned viewer/channel, and verifies baseline ranking instead of calling the history reset helper directly. The two-review duplicate is one issue, not two independent defects.

Reconciled local evidence (not rerun for publication): 6,153/6,153 Desktop package and 102/102 focused on composed production; TypeScript and actual desktop-check passed; exact per-PR base/tree size gates passed. Broad Chromium/mock-bridge run remains 233/234 before the test-only formatting correction, followed by the full affected 66/66. Final test-only B1 delta passed full remote-owned-mentions 20/20 and real lifecycle/authority 16/16. Production/dependencies/build/every served file are equivalent across those test-only deltas. No fresh 234/234, union total, repository-wide just ci, live-relay, native Tauri/WebKit/IME/VoiceOver certification, or current-head CI success is claimed. Historical c98 draft failure remains unattributed, not proof of autofocus causation and not a permanent gate after the accepted present-invariant proof. Existing standalone-stack limitations remain. Source evidence: OUTBOX/MENTION_10055/REPORT.md and OUTBOX/MENTION_C0F1/REPORT.md (the latter supersedes only the former B1 blocker disposition).

Current-head CI and fresh review are pending verification, not covered by old approvals. The evidence and head-specific CI statements below are preserved historical records, superseded by this block for the current head.

• Unit tests: mentionPresentation.test.mjs additions and the new mentionSelectionHistory logic cover bounded per-viewer/per-channel history, clearing on community switch, admitted choices only, and ranking applied to the next snapshot; mentionAdmissionJourney.test.mjs adds the ranking journey.
• Browser tests: mention-picker.spec.ts covers choosing a same-name row via ArrowDown→Tab, publishing its sole exact recipient, then seeing that choice promoted above the initially owned row on the next search — while an open list never moves.

Historical capture state (not these heads)

The following original captions/links are retained as historical capture evidence only; none is relabeled as this restack.

Preserved recent-choice comparison

Historical mock-bridge captures from PR6 22b1d536 and the PR7 production-equivalent build through bce92ee1. These illustrate the ranking preference (the new stable-list lifecycle is different), not a new-head capture or delivery proof.

Before — ownership still ranks first after choosing B

At PR6, the owned Scout stays above the other Scout after the other Scout is selected.

After — the recent explicit choice ranks first

At PR7, choosing the other Scout moves that exact identity above the owned Scout on the next comparable search. The selected recipient does not change.

Integrated stable-picker visuals

Captured integrated f638b9cb — not standalone PR5 and not a capture of this correction. These still illustrate stable rows, action labels and next-open ranking; the earlier correction changed null-destination readiness and fixtures, not those pictured channel states. The duplicate-row image is before Tab, as captioned. No image proves access or delivery.

• Earlier independent-root evidence is historical; current shared-recovery composition validation is recorded below.

Extraction validation update

• This stack builds on the shared fix(desktop): keep your draft editable when an @ mention cannot be sent #7190 recovery baseline, separately from fix(desktop): refresh @ search when channel membership changes #7191 → fix(desktop): show an agent in @ search after you add it to a channel #7192. Chooser, cold-error settlement and ranking production behavior are unchanged by the fixture repairs.
• Desktop lint/format, TypeScript, explicit shared-base file-size checks and E2E builds pass. Targeted send-flow/mention-presentation checks pass. Earlier package 6035/6035 and isolated browser 8/8 remain historical evidence for unchanged semantic inputs, not fresh runs of this composition.
• The fresh composition probe passed 7/8 initially. The Welcome failure was traced to mock parity: create dropped the starter team ID, and add-members omitted the normal membership event. The fixture now preserves team ID, deliberately seeds a same-name collision and delivers that event. Exactly three starter creates prove reuse. The original ambiguous-submit error, retained draft, no-publication and exact-current-starter completion assertions remain.
• Welcome now passes separately on the earliest owning fix(desktop): check access again when you select or pin an @ mention #7196 prefix and final descendant with matching E2E builds. Removing only the fixture membership event fails the roster precondition; restoring it passes. This is not one combined clean eight-test run and does not establish a production freshness dependency on lane B.
• Earlier full browser sweep remains 138/141, with separate separator corrections 2/2 and editor 4/4. No fresh full-suite or all-prefix runtime claim.
• The initial-directory authorization test now holds the actual mock directory response until Loading and no-Quinn assertions finish, rather than spending a one-second delay during navigation. Releasing it passes; withholding release fails eventual visibility. Existing assertions and timeouts are unchanged.
• Independent Welcome fixture review passed; independent held-directory fixture review also passed; earlier helper/shared-base and semantic reviews are retained.
• Fixed the historical profile-hover CI timing failure in separate commit 3825f894, inherited by fix(desktop): order same-name agents using your recent choices #7240. The test now uses the existing animation helper after each hover, before sampling/comparing settled surfaces; exact CSS equality, screenshot and timeouts remain unchanged. Fresh real-browser complete spec 2/2 passed; a disposable wrong-profile-color probe still failed that equality, and a controlled in-flight channel transition reproduced the old .03-versus-.04 failure. Probes removed; no production styling changed. Desktop check/typecheck and fresh E2E build passed. This tiny delta was self-reviewed, not independently re-reviewed.
• Historical pre-workflow-repair CI: run 34271016267 SUCCESS at 9778b2b200fd33592e17d53fd6d7545ab5cdbd37; all applicable jobs passed, including Core, all four smoke shards and both integration shards. DCO passed and GitHub reports no merge conflict. Earlier automatic superseded-run cancellations are not current-run failures. Base fix(desktop): show whether you can mention or invite an agent #7239's workflow-controls Smoke 4 failure was repaired by 2759378 (that suite passed on the terminal run), and its Smoke 1 toast flake was repaired by be1d594 (Smoke 1 green on fix(desktop): show whether you can mention or invite an agent #7239's current run); base fix(desktop): show whether you can mention or invite an agent #7239's remaining gate is an unrelated Smoke 2 flake recorded below. No whole-stack ready/merge claim.
• Authorized workflow fixture repair is a separate, independently revertible commit 27593788, retaining the hover fix unchanged. It targets the actual message textarea during trigger-inspector exit, samples operator boxes together after bounded geometry settlement, and checks the original persisted trigger expression and message text before reopen. Original geometry relations, screenshots, trigger/message semantics and timeouts remain; no production code or snapshot changes. Self-reviewed small test-only delta (+39/-4).
• Reused bounded local proof: corrected diagnostic 1/1 with executed saved-original-content and 416px geometry evidence; wrong-layout and wrong-saved-content controls each fail meaningful assertions (the earlier inert wrapper control is not counted). Affected full browser spec 11/12, not clean: Darwin template-variable snapshot differs by 438 pixels. Lint and application types pass; expanded fixture types show baseline-only errors. No repeat full-suite or controls.
• Screenshot attribution: one executed unchanged-published-fixture control on fix(desktop): show whether you can mention or invite an agent #7239's prior 3825f894d08acb5a12d609fbb100da7d982274f2, same Darwin Playwright configuration and same production served artifact, also fails by 438 pixels. Actual, expected and diff PNGs are each byte-identical to candidate fullspec artifacts. This screenshot test does not call the modified helper and its setup/capture is unchanged. Local HTTP content was verified against all 459 JS/CSS/index files; repair tree is exactly the tested 2a8f9068e9748f7a908b77097c98097b6c91fc7f. This is an inherited Darwin baseline limitation, separate from target repair proof; official Linux CI remains the intended gate. No baseline update, threshold relaxation or icon hiding.
• Prior exact-head CI: run 34276688671 SUCCESS (terminal) at 3fa953a7fdb4190eb5dea71c9f068a1b65524c96 — Desktop Core, all four smoke shards (including channels.spec.ts:1005, which failed only on fix(desktop): show whether you can mention or invite an agent #7239's run) and both integration shards passed. DCO passes; GitHub reports MERGEABLE. Base fix(desktop): show whether you can mention or invite an agent #7239's terminal run failed only that unrelated Smoke 1 flake; no whole-stack ready/merge claim.
• Toast fixture repair inheritance: fix(desktop): show whether you can mention or invite an agent #7239's authorized test-only toast repair be1d594f is replayed beneath this PR unchanged; head 7795b7d5fedf5963dccdb9564e464afd09fd9da1 differs from the prior 3fa953a7fdb4190eb5dea71c9f068a1b65524c96 only by that nine-line channels.spec.ts hunk — no production delta.
• Prior exact-head CI: run 34363497199 SUCCESS (terminal) at 7795b7d5fedf5963dccdb9564e464afd09fd9da1 — Desktop Core, all four smoke shards (including the repaired toast test) and both integration shards passed. DCO passes; GitHub reports MERGEABLE. Base fix(desktop): show whether you can mention or invite an agent #7239's current run 34363489121 failed only the unrelated Smoke 2 mentions.spec.ts:1885 retry-luck flake (attribution on fix(desktop): show whether you can mention or invite an agent #7239); no whole-stack ready/merge claim.
• Mention fixture repair inheritance: base fix(desktop): show whether you can mention or invite an agent #7239's authorized test-only explicit-picker fixture repair f1af1b8 is replayed beneath this PR; head 7d06bf5bebbe75d23132eb6d581557797f55c545 differs from the prior 7795b7d5fedf5963dccdb9564e464afd09fd9da1 only by that eight-line mentions.spec.ts setup hunk — no production delta. The 2/2 zero-retry local proof ran on this exact tree (prior head plus the fixture patch; verified by diff).
• Current exact-head CI: registered, in progress — not observed to completion at 7d06bf5bebbe75d23132eb6d581557797f55c545: run 34371493916 (CI, 15:37:50Z) and run 34371490600 (CI, 15:37:48Z). The prior terminal SUCCESS 34363497199 at 7795b7d5fedf5963dccdb9564e464afd09fd9da1 remains the last completed run. No whole-stack ready/merge claim.

[loganj]

🤖

Stable-picker rewrite — integrated capture

Captured from exact integrated f638b9cb123decc8306b1efce5aadc0ce13b91eb (PR5–7), not the standalone PR5 prefix. Strict isolated Chromium/mock bridge; assets and served cwd verified. Later fixture-only corrections do not change these pixels. These images demonstrate UI state, not live-relay permission or delivery. Historical comparisons remain labelled historical in the PR body.

Recent choice on the next open

After selecting and signing the two exact recipients, the next completion ranks the most recently inserted Scout first. No currently displayed row is reordered.

[jedwards27]

:bot: Jude’s code review agent — REQUEST CHANGES at exact head 7d06bf5bebbe75d23132eb6d581557797f55c545 (base f1af1b88c6458d40080529e8d71a0bdec1868a78).

One author-actionable test defect remains: the claimed community-isolation regression bypasses the production reset seam. Production owns a community-scoped singleton in mentionSelectionHistory.ts:5 and clears it from useCommunityInit.ts:62, but the new tests call resetMentionSelectionHistory() directly rather than driving community reset/switch lifecycle. Removing both the production import and call left all changed evidence green: 44/44 changed unit tests, typecheck, and 3/3 production-built Playwright mention-picker tests. Recent choices can therefore leak across communities in-process while CI remains green.

Author action: add a production-seam regression that records a choice, drives the real community reset/switch path, and proves the old community choice is absent. Removing the resetMentionSelectionHistory() wiring must fail behaviorally.

Verification owner: author for the regression; reviewer to rerun the production-callsite mutation at the replacement immutable head.

No separate identity-key, persistence bound, deterministic ordering, stale-admission, exact-recipient, keyboard-selection, or accessibility defect was found. Full Desktop unit suite 6,064/6,064, check, typecheck, build, file-size gate, rendered mention-picker 3/3, and git diff --check passed at the exact clean head. The initial occupied Playwright port was a reviewer environment collision, not author work.

[jedwards27]

Review verdict: Request changes

Reviewed base f1af1b88c6458d40080529e8d71a0bdec1868a78 → exact head 7d06bf5bebbe75d23132eb6d581557797f55c545.

[P2] Bind community isolation to the production reset seam

desktop/src/features/communities/useCommunityInit.ts:62 is the only wiring that clears the new module-level mention history during a community reset. The added test at desktop/src/features/messages/lib/mentionPresentation.test.mjs:224-233 invokes resetMentionSelectionHistory() directly, so it proves the helper but not that community switching reaches it.

This is falsifiably uncovered: removing the production import/call from useCommunityInit.ts leaves all changed unit tests green (44/44), TypeScript typecheck green, and the changed production-built Playwright mention-picker spec green (3/3). The resulting application would retain prior-community choices in-process, contrary to the PR's stated isolation contract.

Author action: add a production-seam regression that records history, drives the real community reset/switch path, and proves the previous community's choice is absent afterward. Removing the resetMentionSelectionHistory() wiring must make that regression fail.

Other exact-head evidence was green: full Desktop unit suite 6,064/6,064; Desktop build/check/typecheck and file-size checks; production-built mention-picker Playwright 3/3. Identity admission/insertion, exact-recipient propagation, bounded/scoped history, deterministic fallback, and frozen open-picker ordering were also traced without another material defect.

[loganj]

🤖

Addressed review 5159942011, review 5159947440 at exact new head ed502a18b941786a187fb69a54cab47e31c93de5, tree f01223931881fb2a2981deaa7d7b3dae85d6a1a7, base 479bbe0f17d7635c48e00b5f7280350b1d8b2dba.

Closes the shared community-reset coverage finding in reviews 5159942011 and 5159947440. The community-rail regression records a real admitted choice and proves its next-open promotion, drives actual A→B→A community navigation through the production reset seam, binds the returned viewer/channel, and verifies baseline ranking instead of calling the history reset helper directly. The two-review duplicate is one issue, not two independent defects.

Reconciled local evidence (not rerun for publication): 6,153/6,153 Desktop package and 102/102 focused on composed production; TypeScript and actual desktop-check passed; exact per-PR base/tree size gates passed. Broad Chromium/mock-bridge run remains 233/234 before the test-only formatting correction, followed by the full affected 66/66. Final test-only B1 delta passed full remote-owned-mentions 20/20 and real lifecycle/authority 16/16. Production/dependencies/build/every served file are equivalent across those test-only deltas. No fresh 234/234, union total, repository-wide just ci, live-relay, native Tauri/WebKit/IME/VoiceOver certification, or current-head CI success is claimed. Historical c98 draft failure remains unattributed, not proof of autofocus causation and not a permanent gate after the accepted present-invariant proof. Existing standalone-stack limitations remain. Source evidence: OUTBOX/MENTION_10055/REPORT.md and OUTBOX/MENTION_C0F1/REPORT.md (the latter supersedes only the former B1 blocker disposition).

Please re-review the latest head above, not the superseded published head. This response records author closure and requests verification; it is not reviewer approval.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head ed502a18b941786a187fb69a54cab47e31c93de5 (base 479bbe0f17d7635c48e00b5f7280350b1d8b2dba).

The prior production-seam defect is resolved. The new browser regression drives real community-rail A→B→A navigation after recording an admitted exact-identity choice, then requires baseline ordering on return (desktop/tests/e2e/community-rail.spec.ts:479-586). Two independent compiling mutations bypassing resetMentionSelectionHistory() caused that final order assertion to fail; restored exact head passed. A separate mutation removing admitted-insertion recording also failed the expected next-open ranking assertion.

No material defect found in identity scoping, bounded in-memory history, deterministic same-name ordering, stale/denied admission handling, exact-recipient publication, frozen open-picker keyboard selection, or unchanged accessibility semantics.

Exact-head evidence: Desktop unit suite 6,074/6,074; typecheck/build/check and changed-file Biome; full affected browser specs 29/29; git diff --check; clean tree f01223931881fb2a2981deaa7d7b3dae85d6a1a7. Current CI is terminal green for Desktop Core, all four smoke shards, relay E2E, both integration shards, macOS/Windows builds, DCO, Semgrep, and zizmor; cancelled duplicate jobs are superseded. Native Tauri/WKWebView, IME, and VoiceOver were not rerun, but this frontend-only in-memory ordering/reset change introduces no new native or accessibility implementation surface.

Author action: none.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: 479bbe0f17d7635c48e00b5f7280350b1d8b2dba..ed502a18b941786a187fb69a54cab47e31c93de5 (exact live head ed502a18b941786a187fb69a54cab47e31c93de5)
Risk: moderate — in-memory exact-identity ranking crosses selection snapshots and community reset lifecycle, without native or durable persistence changes.

Both assigned lanes completed and agree the prior production-reset coverage blocker is closed. The new browser regression drives actual community-rail A→B→A navigation, first proves successful exact-key insertion changes the next snapshot, binds viewer/channel through publication, then requires baseline order on return (desktop/tests/e2e/community-rail.spec.ts:479-586). This reaches canonical useCommunityInit reset wiring (desktop/src/features/communities/useCommunityInit.ts:62,251-286). Two independent compiling bypass mutations of the production reset invocation built successfully but failed the final order assertion; restoration passed.

The remaining contracts hold: history is normalized, memory-only, bounded to 50 keys per scope and 100 scopes, and scoped by exact viewer+channel (mentionSelectionHistory.ts:3-44). Recording occurs only after current request/snapshot/admission/cursor guards pass (useMentions.ts:528-547,585-603). Ranking affects only actionable same-name identity-agent slots tied on group/score/name, then uses recent → owned → presence → exact key; unrelated rows keep their slots (mentionRanking.ts:121-209). Each open picker clones and freezes a row snapshot, so live updates cannot redirect keyboard selection (useMentionSelection.ts:7-53).

Author action: none.
Verification owner: release-level native Tauri/WKWebView, IME, or VoiceOver observation if desired; none is required as author rework.

Exact-head validation on clean trees:

• Full Desktop unit package passed 6,074/6,074.
• pnpm typecheck, full pnpm check, changed-file Biome, E2E build, and git diff --check passed.
• Both affected browser specs passed 29/29 on an isolated port.
• Production reset bypass mutation and admitted-insertion recording mutation each failed their intended browser journey and were restored.
• Exact-head Desktop Core, all four smoke shards, relay E2E, both integration shards, macOS/Windows builds, DCO, and security checks passed. Cancelled duplicate checks belong to a superseded run.

Manual/native evidence: no native Tauri/WKWebView, IME, or VoiceOver run. This change adds no new rendering or OS-input semantics; production-path mock-bridge coverage and exact-head CI are proportionate.

Residual risk: session-only recency intentionally disappears on restart and is reset across communities. No identity, tenancy, ordering, selection-stability, persistence, or accessibility defect remains. Any new head invalidates this approval.